This can be done with the following URL

http://<IP address of the device>:<web port of the device>/wps-cgi/mjpg/video.cgi?camera=<number>&resolution=640x480&username=<user>&password=<password>

Where IP address is the NVR and port is the port the NVR has assigned to reach through to the camera i.e. 65001, 65002 etc. 

Camera number is the camera number on the NVR and username and password is that set on the camera

basically the NVR passes the URL through tot he camera

You do need to set the substream to MJPEG for this to work as it pulls the substream. 

See